CVE-2014-3596

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-3596
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

5.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://linux.oracle.com/errata/ELSA-2014-1193.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html
http://rhn.redhat.com/errata/RHSA-2014-1193.html
http://secunia.com/advisories/61222
http://www.openwall.com/lists/oss-security/2014/08/20/2
http://www.securityfocus.com/bid/69295
http://www.securitytracker.com/id/1030745
https://exchange.xforce.ibmcloud.com/vulnerabilities/95377
https://issues.apache.org/jira/browse/AXIS-2905 Patch
https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E
https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E
https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E
https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E
https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E
https://www.oracle.com/security-alerts/cpujan2020.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.0:beta:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.1:beta:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.1:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.1:rc2:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:beta1:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:beta2:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:beta3:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:rc2:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2:rc3:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:axis:1.3:*:*:*:*:*:*:*
History

13 Feb 2023, 00:40

Type Values Removed Values Added
Summary It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-3596', 'name': 'https://access.redhat.com/security/cve/CVE-2014-3596', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:1193', 'name': 'https://access.redhat.com/errata/RHSA-2014:1193', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1129935', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1129935', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1010', 'name': 'https://access.redhat.com/errata/RHSA-2015:1010', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:17

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c@%3Cjava-dev.axis.apache.org%3E', 'name': '[axis-java-dev] 20190503 [jira] [Comment Edited] (AXIS-2905) Insecure certificate validation CVE-2014-3596', 'tags': [], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d@%3Cjava-dev.axis.apache.org%3E', 'name': '[axis-java-dev] 20190909 [jira] [Resolved] (AXIS-2905) Insecure certificate validation CVE-2014-3596', 'tags': [], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780@%3Cjava-dev.axis.apache.org%3E', 'name': '[axis-java-dev] 20190909 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596', 'tags': [], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832@%3Cjava-dev.axis.apache.org%3E', 'name': '[axis-java-dev] 20190907 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596', 'tags': [], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5@%3Cjava-dev.axis.apache.org%3E', 'name': '[axis-java-dev] 20190503 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596', 'tags': [], 'refsource': 'MLIST'}
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-3596 -
  • (MISC) https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1129935 -
  • (MISC) https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:1193 -
  • (MISC) https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1010 -
  • (MISC) https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E -
  • (MISC) https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E -
Summary The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784. It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Information

Published : 2014-08-27 00:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-3596

Mitre link : CVE-2014-3596

CVE.ORG link : CVE-2014-3596

JSON object : View

Products Affected

apache

  • axis
CWE
NVD-CWE-Other